identitymanager

Documentation

Overview

Package identitymanager provides an interface, and its implementation, to handle the creation and the issue process of an identity for a remote cluster.

Index

• Constants
• func EnsureCertificate(ctx context.Context, idp IdentityProvider, options *SigningRequestOptions) (*responsetypes.SigningRequestResponse, error)
• type IdentityManager
  • func NewCertificateIdentityManager(ctx context.Context, cl client.Client, k8sClient kubernetes.Interface, ...) IdentityManager
• type IdentityProvider
  • func NewCertificateIdentityProvider(ctx context.Context, cl client.Client, k8sClient kubernetes.Interface, ...) IdentityProvider
  • func NewIAMIdentityProvider(ctx context.Context, cl client.Client, k8sClient kubernetes.Interface, ...) IdentityProvider
• type IdentityReader
  • func NewCertificateIdentityReader(ctx context.Context, cl client.Client, k8sClient kubernetes.Interface, ...) IdentityReader
• type LocalAwsConfig
  • func (ac *LocalAwsConfig) IsEmpty() bool
• type SigningRequestOptions

Constants

const (

	// APIServerURLSecretKey key used for the api server url inside the secret.
	APIServerURLSecretKey = "apiServerUrl"

	// AwsAccessKeyIDSecretKey is the key used for the AWS access key ID inside the secret.
	AwsAccessKeyIDSecretKey = "awsAccessKeyID"
	// AwsSecretAccessKeySecretKey is the key used for the AWS secret access key inside the secret.
	AwsSecretAccessKeySecretKey = "awsSecretAccessKey"
	// AwsRegionSecretKey is the key used for the AWS region inside the secret.
	AwsRegionSecretKey = "awsRegion"
	// AwsEKSClusterIDSecretKey is the key used for the AWS EKS cluster ID inside the secret.
	AwsEKSClusterIDSecretKey = "awsEksClusterID" //nolint:gosec // not a credential
	// AwsIAMUserArnSecretKey is the key used for the AWS IAM user ARN inside the secret.
	AwsIAMUserArnSecretKey = "awsIamUserArn" //nolint:gosec // not a credential
)

const (

	// CertificateAvailableLabel is the label used to identify the secrets containing a certificate.
	CertificateAvailableLabel = "liqo.io/certificate-available"
)

Functions

func EnsureCertificate

func EnsureCertificate(ctx context.Context, idp IdentityProvider, options *SigningRequestOptions) (*responsetypes.SigningRequestResponse, error)

EnsureCertificate ensures that the certificate is present with the identity provider.

Types

type IdentityManager

type IdentityManager interface {
	IdentityReader

	StoreIdentity(ctx context.Context, remoteCluster liqov1beta1.ClusterID, namespace string, key []byte,
		remoteProxyURL string, identityResponse *auth.CertificateIdentityResponse) error
}

IdentityManager interface provides the methods to manage identities for the remote clusters.

func NewCertificateIdentityManager

func NewCertificateIdentityManager(ctx context.Context,
	cl client.Client, k8sClient kubernetes.Interface, cnf *rest.Config,
	localCluster liqov1beta1.ClusterID, namespaceManager tenantnamespace.Manager) IdentityManager

NewCertificateIdentityManager gets a new certificate identity manager.

type IdentityProvider

type IdentityProvider interface {
	// deprecated
	GetRemoteCertificate(ctx context.Context, options *SigningRequestOptions) (response *responsetypes.SigningRequestResponse, err error)
	// deprecated
	ApproveSigningRequest(ctx context.Context, options *SigningRequestOptions) (response *responsetypes.SigningRequestResponse, err error)
	ForgeAuthParams(ctx context.Context, options *SigningRequestOptions) (*authv1beta1.AuthParams, error)
}

IdentityProvider provides the interface to retrieve and approve remote cluster identities.

func NewCertificateIdentityProvider

func NewCertificateIdentityProvider(ctx context.Context, cl client.Client, k8sClient kubernetes.Interface,
	cnf *rest.Config,
	localCluster liqov1beta1.ClusterID, namespaceManager tenantnamespace.Manager) IdentityProvider

NewCertificateIdentityProvider gets a new certificate identity approver.

func NewIAMIdentityProvider

func NewIAMIdentityProvider(ctx context.Context, cl client.Client, k8sClient kubernetes.Interface,
	localCluster liqov1beta1.ClusterID, localAwsConfig *LocalAwsConfig,
	namespaceManager tenantnamespace.Manager) IdentityProvider

NewIAMIdentityProvider gets a new identity approver to handle IAM identities.

type IdentityReader

type IdentityReader interface {
	GetConfig(remoteCluster liqov1beta1.ClusterID, namespace string) (*rest.Config, error)
	GetConfigFromSecret(remoteCluster liqov1beta1.ClusterID, secret *corev1.Secret) (*rest.Config, error)
	GetRemoteTenantNamespace(remoteCluster liqov1beta1.ClusterID, namespace string) (string, error)
	GetSecretNamespacedName(remoteCluster liqov1beta1.ClusterID, namespace string) (types.NamespacedName, error)
}

IdentityReader provides the interface to retrieve the identities for the remote clusters.

func NewCertificateIdentityReader

func NewCertificateIdentityReader(ctx context.Context, cl client.Client, k8sClient kubernetes.Interface, cnf *rest.Config,
	localCluster liqov1beta1.ClusterID, namespaceManager tenantnamespace.Manager) IdentityReader

NewCertificateIdentityReader gets a new certificate identity reader.

type LocalAwsConfig

type LocalAwsConfig struct {
	AwsAccessKeyID     string
	AwsSecretAccessKey string
	AwsRegion          string
	AwsClusterName     string

	// these ones are filled at runtime in the init function
	AwsClusterEndpoint string
	AwsClusterCA       []byte
}

LocalAwsConfig contains the AWS configuration and access key for the Liqo user and the current EKS cluster.

func (*LocalAwsConfig) IsEmpty

func (ac *LocalAwsConfig) IsEmpty() bool

IsEmpty indicates that some of the required values is not set.

type SigningRequestOptions

type SigningRequestOptions struct {
	Cluster         liqov1beta1.ClusterID
	TenantNamespace string
	IdentityType    authv1beta1.IdentityType
	Name            string
	SigningRequest  []byte

	// optional
	APIServerAddressOverride string
	CAOverride               []byte
	TrustedCA                bool
	ResourceSlice            *authv1beta1.ResourceSlice
	ProxyURL                 *string
}

SigningRequestOptions contains the options to handle a signing request.